PT-2003-2154 · Mambo · Mambo Site Server

Publicado 2003-12-31 · Atualizado 2017-07-11 · CVE-2003-1204

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mambo Site Server versions 4.0.12 BETA and earlier

Description The issue allows remote attackers to execute scripts on other clients via multiple parameters in various PHP files, including the link parameter in "sectionswindow.php", the directory parameter in "gallery.php", "navigation.php", or "uploadimage.php", the path parameter in "view.php", the choice parameter in "upload.php", the sitename parameter in "mambosimple.php", the type parameter in "upload.php", or the id parameter in "emailarticle.php", "emailfaq.php", or "emailnews.php".

Recommendations For Mambo Site Server versions 4.0.12 BETA and earlier, update to a version later than 4.0.12 BETA to resolve the issue. As a temporary workaround, consider restricting access to the affected PHP files until a patch is available. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2003-1204

Produtos afetados

Mambo Site Server

Referências · 15

• 🔥 http://securityfocus.com/archive/1/306206 · Exploit
• http://osvdb.org/7502 · Nota
• http://securityfocus.com/bid/6571 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1204 · Nota de Segurança
• http://osvdb.org/7501 · Nota
• http://osvdb.org/7498 · Nota
• http://osvdb.org/7505 · Nota
• http://osvdb.org/7497 · Nota
• http://osvdb.org/7503 · Nota
• http://osvdb.org/7500 · Nota
• http://osvdb.org/7499 · Nota
• http://osvdb.org/7495 · Nota
• http://osvdb.org/7504 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11050 · Nota
• http://osvdb.org/7496 · Nota